ARCH-02 — Canonical repository resources, transport identity, and authorized lookup #828

New Issue

2026-07-22T19:45:07-05:00

jcwalker3 commented

2026-07-22 19:45:07 -05:00

Candidate architecture requiring executable validation; not yet approved, production-ready, or certified.

Parent: #820. Epic, not an implementation leaf.

ARCH-02 overall invariants

Canonical resource identity is transport-backed and project-independent; two projects over one repository never lock independently. [SCHEMA].
Authorization to create/lookup a resource derives from binding-level grants, never from associations that cannot exist until the resource does. [SCHEMA] + [TRUSTED-SERVICE].
Git ref identity has one explicit, justified byte/UTF-8 policy; byte-distinct refs are never silently aliased. [TRUSTED-SERVICE] canonicalizer + [SCHEMA] storable subset.
Lookup authorization on SQLite is [TRUSTED-SERVICE] (no table-level read privileges/SELECT triggers); PostgreSQL may use SECURITY DEFINER / security-barrier views.

Enforcement-label vocabulary

[SCHEMA] · [TRUSTED-SERVICE] · [RUNTIME-ADAPTER].

Children (resolved issue numbers)

#829 — Transport identity authorities, external bindings, and reconciliation lifecycle
#830 — Canonical resource identity and byte-safe Git reference handling
#831 — Project-scoped repository associations and authorized resource lookup

Definition of done (epic)

All three children merged with executable tests; acceptance matrix (#837) cross-references ARCH-02 invariants.

Known limitations / deferred

Depends on ARCH-01 grants/evidence for authorization and external-id proofs (#822, #826). PostgreSQL parity for ARCH-02 tracked with each child's PG section.

**Candidate architecture requiring executable validation; not yet approved, production-ready, or certified.** Parent: #820. **Epic, not an implementation leaf.** ## ARCH-02 overall invariants - Canonical resource identity is **transport-backed and project-independent**; two projects over one repository never lock independently. `[SCHEMA]`. - Authorization to create/lookup a resource derives from **binding-level grants**, never from associations that cannot exist until the resource does. `[SCHEMA]` + `[TRUSTED-SERVICE]`. - Git ref identity has one explicit, justified byte/UTF-8 policy; byte-distinct refs are never silently aliased. `[TRUSTED-SERVICE]` canonicalizer + `[SCHEMA]` storable subset. - Lookup authorization on SQLite is `[TRUSTED-SERVICE]` (no table-level read privileges/SELECT triggers); PostgreSQL may use SECURITY DEFINER / security-barrier views. ## Enforcement-label vocabulary `[SCHEMA]` · `[TRUSTED-SERVICE]` · `[RUNTIME-ADAPTER]`. ## Children (resolved issue numbers) - [ ] #829 — Transport identity authorities, external bindings, and reconciliation lifecycle - [ ] #830 — Canonical resource identity and byte-safe Git reference handling - [ ] #831 — Project-scoped repository associations and authorized resource lookup ## Definition of done (epic) All three children merged with executable tests; acceptance matrix (#837) cross-references ARCH-02 invariants. ## Known limitations / deferred Depends on ARCH-01 grants/evidence for authorization and external-id proofs (#822, #826). PostgreSQL parity for ARCH-02 tracked with each child's PG section.

jcwalker3 referenced this issue

2026-07-22 19:45:52 -05:00

ARCH-02 — Transport identity authorities, external bindings, and reconciliation lifecycle #829

jcwalker3 referenced this issue

2026-07-22 19:46:46 -05:00

ARCH-02 — Canonical resource identity and byte-safe Git reference handling #830

jcwalker3 referenced this issue

2026-07-22 19:47:26 -05:00

ARCH-02 — Project-scoped repository associations and authorized resource lookup #831

jcwalker3 referenced this issue

2026-07-22 20:04:09 -05:00

Architecture program — role-delivery-reliability control plane #820